Some links on this page are affiliate links. We may earn a commission when you click through and make a purchase, at no additional cost to you.
The latest Wordfence Intelligence report reveals 159 new vulnerabilities across 142 WordPress plugins and 2 themes disclosed last week. This surge underscores the continued pressure on WordPress sites to maintain vigilant security practices amid an evolving threat landscape.
- 159 vulnerabilities disclosed affecting 142 plugins and 2 themes, with 134 patched and 25 unpatched.
- Critical vulnerabilities include an unauthenticated authentication bypass in UpdraftPlus, now protected by Wordfence firewall rules for premium users.
- Cross-site scripting (XSS), missing authorization, and SQL injection remain the most prevalent vulnerability types.
- Wordfence provides free access to its vulnerability database, CLI scanner, and APIs, enabling proactive defense across individual and enterprise WordPress environments.
- Security researchers play a vital role, with 96 contributors adding to the ecosystem’s protection this week.
What Happened
Between June 1 and June 7, 2026, Wordfence Intelligence added 159 newly disclosed vulnerabilities to its WordPress vulnerability database. These affected 142 plugins and 2 themes. Of these, 134 vulnerabilities were patched by the respective developers, while 25 remained unpatched at the time of reporting.
The vulnerabilities varied in severity: 9 were rated critical, 53 high, 96 medium, and 1 low according to the CVSS scoring system. The most common vulnerability types included cross-site scripting (43), missing authorization (28), deserialization of untrusted data (17), and SQL injection (16).
One notable vulnerability addressed was in the widely used UpdraftPlus plugin (version 1.26.4 and below), which contained an unauthenticated authentication bypass via UpdraftCentral’s udrpc endpoint. Wordfence deployed firewall rules for this vulnerability immediately to its Premium, Care, and Response customers, with free version users receiving protection after a 30-day delay.
The report also highlighted the contributions of 96 security researchers who responsibly disclosed vulnerabilities, ranging from prolific reporters like Frissi0n and daroo (8 vulnerabilities each) to many others contributing one or two discoveries.
Wordfence continues to offer its vulnerability database, CLI scanner, API, and webhook integrations for free, empowering WordPress site owners, agencies, and hosts to implement layered security measures.
Why This Matters
In real hosting environments, WordPress remains the most targeted CMS platform due to its widespread use. The volume of vulnerabilities disclosed weekly illustrates the dynamic and persistent threat landscape that site operators must navigate.
The high incidence of cross-site scripting and missing authorization vulnerabilities reveals ongoing challenges with input validation and access control in plugin development. These weaknesses can lead to data theft, site defacement, or full site compromise, especially if exploited in popular plugins.
The unauthenticated authentication bypass in UpdraftPlus is particularly concerning because it allows attackers to bypass login controls without credentials — a critical security failure in a plugin responsible for backups and migrations, which are core to site integrity and recovery.
Wordfence’s role as a vulnerability database provider and firewall vendor is significant. By offering free access to its data and tools, it democratizes security intelligence, enabling not only enterprises but also smaller agencies and individual site owners to scan for vulnerabilities and receive real-time alerts. This aligns with defense-in-depth security models that require not relying solely on plugin updates but layering protections.
However, a trade-off exists for free Wordfence users who receive firewall protections with a 30-day delay. In fast-moving attack scenarios, this gap could be exploited, emphasizing the value of premium security services or alternative mitigation strategies for high-risk sites.
The involvement of nearly a hundred security researchers each week reflects a healthy security ecosystem around WordPress. It also highlights the importance of responsible disclosure programs and incentivization to maintain this flow of critical information.
What This Means for WordPress Users
Agencies managing multiple client sites should integrate Wordfence Intelligence’s CLI Vulnerability Scanner and vulnerability API into their security workflows. Automating vulnerability scanning allows early detection and prioritization of patching efforts across complex site portfolios.
Developers building plugins or themes must double down on secure coding practices, particularly around input sanitization, authorization checks, and deserialization routines. The prevalence of common vulnerability types suggests many plugins still lack robust security reviews.
Hosting providers can leverage Wordfence’s free and premium tools to offer managed security layers to their customers, reducing the risk of exploitation and support costs related to breaches.
Site operators should subscribe to Wordfence’s vulnerability mailing list and regularly review plugin updates. They should also consider installing Wordfence’s firewall and scanner plugins to add real-time protection and vulnerability detection.
Given the delay in firewall rule deployment for free users, critical sites should evaluate the cost-benefit of Wordfence Premium or alternative security layers to close exposure windows.
Frequently Asked Questions
- How can I tell if my WordPress site is affected by these vulnerabilities?
- Check your installed plugins and themes against the latest Wordfence Intelligence vulnerability database. Using the Wordfence CLI scanner or API integrations can automate this check across multiple sites.
- What should I do if a plugin I use has an unpatched vulnerability?
- Immediately assess the severity of the vulnerability and consider disabling the plugin temporarily. Follow vendor updates closely and apply patches as soon as they become available. Layered security measures like web application firewalls can help mitigate risk in the interim.
- Is the Wordfence firewall effective against newly disclosed vulnerabilities?
- Wordfence rapidly creates and deploys firewall rules for critical vulnerabilities to premium users. Free users receive these protections after a 30-day delay, which might leave some exposure. Consider upgrading or implementing additional security controls accordingly.
- How does Wordfence Intelligence benefit developers?
- Developers gain access to detailed vulnerability data, helping them understand common security pitfalls and improve their code quality to avoid introducing similar issues.
- Can I contribute to WordPress security research and get recognized?
- Yes, responsible disclosure of vulnerabilities to Wordfence through their Bug Bounty Program can earn you a bounty and inclusion on their leaderboard, encouraging community participation in securing WordPress.
Sources: Wordfence Blog – Weekly Vulnerability Report, WordPress.org, UpdraftPlus
